Editing Cluster Operations (section)

=== Clean Up ===
At this point we can remove any old DNs from the <code>opensearch.yml</code> configurations and in general remove all traces of the old certificates in the cluster nodes and clients.  If a restart is warranted to verify that nothing critical was deleted, that should be done at this time.

It is not necessary to replace the new CA bundle with the CA certificate -- it serves no purpose as the old cert is just along for the ride at this point, and once it reaches its expiration date, will not be used.  If it must be done, use the same process above that was used to install the CA bundle, performing a rolling restart on each node as it is completed.